Pentagon supply chain fails to meet basic national security standards

Most contractors hired by the Department of Defense over the past five years have failed to meet required minimum cybersecurity standards, posing a significant risk to US national security.

Managed services provider CyberSheath released a report on Nov. 30 showing that 87% of the Pentagon’s supply chain fails to meet basic cybersecurity minimums. These security breaches subject major defense contractors and their contractors to cyberattacks from a range of threat actors that endanger the national security of the United States.

These risks have been well known for quite some time with no attempts to correct them. This independent Defense Industrial Base (DIB) study is the first to show that federal contractors are not properly securing military secrets, according to CyberSheath.

The DIB is a complex supply chain made up of 300,000 prime contractors and subcontractors. The government allows these licensed companies to share sensitive files and communicate securely to do their jobs.

Defense contractors will soon be required to meet CMMC (Cybersecurity Maturity Model Certification) compliance to protect these secrets. Meanwhile, the report warns that nation-state hackers are actively and specifically targeting these contractors with sophisticated cyberattack campaigns.

“Awarding contracts to federal contractors without first validating their cybersecurity controls has been a complete failure,” Eric Noonan, CEO of CyberSheath, told TechNewsWorld.

Defense contractors have been mandated to meet cybersecurity compliance requirements for over five years. These terms are embedded in more than a million contracts, he added.

Dangerous details

The 2022 Merrill Research Report, commissioned by CyberSheath, found that 87% of federal contractors have an SPRS (Supplier Performance Risk System) score below 70. The metric shows how well a contractor meets the requirements of the Supplement to the Federal Defense Acquisitions (DFARS).

DFARS has been in effect since 2017 and requires a score of 110 for full compliance. Critics of the system anecdotally felt that 70 was “good enough”. Even so, the overwhelming majority of entrepreneurs are still short.

ADVERTISING

“The report’s findings show a clear and present danger to our national security,” said Eric Noonan. “We often hear about the dangers of supply chains that are susceptible to cyberattacks.”

The DIB is the Pentagon’s supply chain, and we see how woefully ill-prepared contractors are despite being in the crosshairs of threat actors, he continued.

“Our military secrets are not secure, and there is an urgent need to improve the state of cybersecurity for this group, which often fails to meet even the most basic cybersecurity requirements,” Noonan warned.

More report results

Survey data came from 300 US-based DoD contractors, with accuracy tested at the 95% confidence level. The study was completed in July and August 2022, with CMMC 2.0 on the horizon.

About 80% of DIB users failed to monitor their computer systems around the clock and did not have US-based security monitoring services. Further shortcomings were evident in the following categories that will be required to achieve CMMC compliance:

• 80% don’t have a vulnerability management solution
• 79% lack a comprehensive multi-factor authentication (MFA) system
• 73% don’t have an endpoint detection and response (EDR) solution
• 70% have not deployed security information and event management (SIEM)

These security checks are legally required of the DIB, and since they are not adhered to, there is significant risk to the DoD and its ability to conduct an armed defense. In addition to being largely non-compliant, 82% of contractors find it “moderately to extremely difficult to understand government cybersecurity regulations.”

Creeping confusion among entrepreneurs

According to the report, some DIB defense contractors focused on cybersecurity only to be blocked by obstacles.

When asked to rate DFARS reporting difficulties on a scale of 1 to 10 (10 being extremely difficult), approximately 60% of all respondents rated “understanding of requirements” at seven out of 10 or higher . Routine documentation and reporting also topped the list of challenges.

The top barriers listed by entrepreneurs are difficulties in understanding the steps needed to achieve compliance, difficulty in implementing sustainable CMMC policies and procedures, and the overall cost involved.

Unfortunately, these results closely matched what CyberSheath expected, admitted Noonan. He noted that research has confirmed that even basic cybersecurity measures like multi-factor authentication have been largely ignored.

“This research, combined with the False Claims Act case against defense giant Aerojet Rocketdyne, shows that defense contractors large and small are failing to meet their contractual cybersecurity obligations and that the DoD has a systemic risk throughout its supply chain,” Noonan said.

No big surprise

Noonan thinks the DoD has long known that the defense industry doesn’t deal with cybersecurity. Reports of seemingly endless nation-state abuses against defense contractors, including large-scale incidents like the SolarWinds and False Claims Act cases, prove this.

“I also believe the DoD has lost patience after giving contractors years to fix the problem. Only now will the DoD make cybersecurity a mainstay of contract acquisition,” Noonan said.

He noted that the DoD’s planned new principle would be “No cybersecurity, no contract.”

ADVERTISING

Noonan admitted that some of the difficulties expressed by entrepreneurs regarding difficulties in understanding and meeting cyber requirements are valid.

“That’s a fair point because some of the messaging from the government has been inconsistent. In reality, however, the requirements have not changed since around 2017,” he proposed.

And after

Perhaps the DoD will pursue a tough policy with contractors. If contractors met the requirements of the law in 2017, the entire supply chain would be in much better shape today. Despite some communication issues, the DoD has been incredibly consistent on what is required for defense contractor cybersecurity, Noonan added.

Current research now sits atop a mountain of evidence that proves that federal contractors have a lot of work to do to improve cybersecurity. It is clear that the job will not be done without enforcement by the federal government.

“Trust without verification has failed, and now the DoD seems to want to mandate verification,” he said.

DoD response still pending

TechNewsWorld submitted written questions to the DoD about criticisms of the supply chain in the CyberSheath report. A CYBER/IT/DOD CIO spokesperson for the Department of Defense responded, saying it would take a few days to dig into the issues. We’ll update this story with any response we receive.